Configuring the LDAP Inactivity Setting

Additional Server Configuration 6-7 ■ Set the userldapconnectionreadtimeout long property from the datastore group to the read timeout in seconds to configure the LDAP user data store read timeout: setConfigPropertydatastore, userldapconnectionreadtimeout, long, 10 ■ Set the fedldapconnectionreadtimeout long property from the datastore group to the read timeout in seconds to configure the LDAP federation data store read timeout: setConfigPropertydatastore, fedldapconnectionreadtimeout, long, 10

6.3.3 ECID Support for LDAP Connections

Oracle Identity Federation 11g supports execution context ID ECID for DMS and audit purposes. When creating an LDAP connection with Oracle Internet Directory, Oracle Identity Federation can pass the ECID context to the OID LDAP Connection. This feature is disabled by default. To enable disable the feature, set the following properties to true false: ■ Set the ldapuseecid boolean property in authnengines group of config for LDAP authn engine ■ Set the userldapuseecid boolean property in authnengines group of config for the LDAP user store ■ Set the fedldapuseecidboolean property in authnengines group of config for LDAP federation data store

6.4 Additional Configuration for High Availability

This section contains additional topics for high availability configuration: ■ Configuring High Availability LDAP Servers ■ Configuring the HTTP Session State SleepRetry Interval

6.4.1 Configuring High Availability LDAP Servers

By default, Oracle Identity Federation is not configured to integrate with a high availability LDAP server. To integrate Oracle Identity Federation with HA LDAP servers to serve as user data store, federation data store, or authentication engine, Oracle Identity Federation needs to be configured for based on the LDAP servers function. Enter the WLST script environment for Oracle Identity Federation, then set the following properties as needed: ■ To integrate the user data store with an HA LDAP server, set the userldaphaenabled boolean property from the datastore group to true; otherwise set it to false: setConfigPropertydatastore, Note: The LDAP server for which ECID support is being enabled must be Oracle Internet Directory 11g Release 1 11.1.1 or later. 6-8 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation userldaphaenabled, true, boolean ■ To integrate the Federation Data Store with an HA LDAP server, set the fedldaphaenabled boolean property from the datastore group to true; otherwise set it to false: setConfigPropertydatastore, fedldaphaenabled, true, boolean ■ To integrate the LDAP authentication engine with an HA LDAP server, set the ldaphaenabled boolean property from the authnengines group to true; otherwise set it to false: setConfigPropertyauthnengines, ldaphaenabled, true, boolean

6.4.2 Configuring the HTTP Session State SleepRetry Interval

When Oracle Identity Federation is deployed in HA mode in a cluster, it can be configured so that the User HTTP session state is replicated across the Oracle WebLogic servers where Oracle Identity Federation is running. By default the HTTP session state replication is disabled for Oracle Identity Federation. To enable it, refer to Cluster-Wide Configuration Changes in the Oracle Fusion Middleware High Availability Guide. The rest of this section provides some additional configuration for Oracle Identity Federation when HTTP session state replication is enabled. This additional configuration allows the user to visit different Oracle Identity Federation servers without encountering any errors during processing of a federation request. Sometimes, the HTTP session state is not replicated fast enough between server instances, generating an error when the user accesses a service in an Oracle Identity Federation instance to which the state has not yet been copied. You can choose one of two options to avoid this issue: ■ Enable sticky sessions on the load balancer to force a specific user to visit the same Oracle WebLogic Server managed server every time it sends an HTTP request; or ■ Set additional configuration properties in Oracle Identity Federation so that, when the server detects that the HTTP session state has not been replicated yet, it can wait to allow the information to be copied. You can enable this feature and configure the wait time. Note: For performance reasons, disabling HTTP session state replication is the preferred approach. Note: For performance reasons, enabling sticky sessions is the preferred approach.